/src/mbedtls/library/psa_crypto_ffdh.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * PSA FFDH layer on top of Mbed TLS crypto |
3 | | */ |
4 | | /* |
5 | | * Copyright The Mbed TLS Contributors |
6 | | * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
7 | | */ |
8 | | |
9 | | #include "common.h" |
10 | | |
11 | | #if defined(MBEDTLS_PSA_CRYPTO_C) |
12 | | |
13 | | /* This header is only needed because it defines |
14 | | * MBEDTLS_DHM_RFC7919_FFDHEXXXX_[P|G]_BIN symbols that are used in |
15 | | * mbedtls_psa_ffdh_set_prime_generator(). Apart from that, this module |
16 | | * only uses bignum functions for arithmetic. */ |
17 | | #include <mbedtls/dhm.h> |
18 | | |
19 | | #include <psa/crypto.h> |
20 | | #include "psa_crypto_core.h" |
21 | | #include "psa_crypto_ffdh.h" |
22 | | #include "psa_crypto_random_impl.h" |
23 | | #include "mbedtls/platform.h" |
24 | | #include "mbedtls/error.h" |
25 | | |
26 | | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \ |
27 | | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE) || \ |
28 | | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) || \ |
29 | | defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH) |
30 | | static psa_status_t mbedtls_psa_ffdh_set_prime_generator(size_t key_size, |
31 | | mbedtls_mpi *P, |
32 | | mbedtls_mpi *G) |
33 | 0 | { |
34 | 0 | const unsigned char *dhm_P = NULL; |
35 | 0 | const unsigned char *dhm_G = NULL; |
36 | 0 | size_t dhm_size_P = 0; |
37 | 0 | size_t dhm_size_G = 0; |
38 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
39 | |
|
40 | 0 | if (P == NULL && G == NULL) { |
41 | 0 | return PSA_ERROR_INVALID_ARGUMENT; |
42 | 0 | } |
43 | | |
44 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048) |
45 | 0 | static const unsigned char dhm_P_2048[] = |
46 | 0 | MBEDTLS_DHM_RFC7919_FFDHE2048_P_BIN; |
47 | 0 | static const unsigned char dhm_G_2048[] = |
48 | 0 | MBEDTLS_DHM_RFC7919_FFDHE2048_G_BIN; |
49 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 */ |
50 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072) |
51 | 0 | static const unsigned char dhm_P_3072[] = |
52 | 0 | MBEDTLS_DHM_RFC7919_FFDHE3072_P_BIN; |
53 | 0 | static const unsigned char dhm_G_3072[] = |
54 | 0 | MBEDTLS_DHM_RFC7919_FFDHE3072_G_BIN; |
55 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 */ |
56 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096) |
57 | 0 | static const unsigned char dhm_P_4096[] = |
58 | 0 | MBEDTLS_DHM_RFC7919_FFDHE4096_P_BIN; |
59 | 0 | static const unsigned char dhm_G_4096[] = |
60 | 0 | MBEDTLS_DHM_RFC7919_FFDHE4096_G_BIN; |
61 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 */ |
62 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144) |
63 | 0 | static const unsigned char dhm_P_6144[] = |
64 | 0 | MBEDTLS_DHM_RFC7919_FFDHE6144_P_BIN; |
65 | 0 | static const unsigned char dhm_G_6144[] = |
66 | 0 | MBEDTLS_DHM_RFC7919_FFDHE6144_G_BIN; |
67 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 */ |
68 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192) |
69 | 0 | static const unsigned char dhm_P_8192[] = |
70 | 0 | MBEDTLS_DHM_RFC7919_FFDHE8192_P_BIN; |
71 | 0 | static const unsigned char dhm_G_8192[] = |
72 | 0 | MBEDTLS_DHM_RFC7919_FFDHE8192_G_BIN; |
73 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 */ |
74 | |
|
75 | 0 | switch (key_size) { |
76 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048) |
77 | 0 | case sizeof(dhm_P_2048): |
78 | 0 | dhm_P = dhm_P_2048; |
79 | 0 | dhm_G = dhm_G_2048; |
80 | 0 | dhm_size_P = sizeof(dhm_P_2048); |
81 | 0 | dhm_size_G = sizeof(dhm_G_2048); |
82 | 0 | break; |
83 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 */ |
84 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072) |
85 | 0 | case sizeof(dhm_P_3072): |
86 | 0 | dhm_P = dhm_P_3072; |
87 | 0 | dhm_G = dhm_G_3072; |
88 | 0 | dhm_size_P = sizeof(dhm_P_3072); |
89 | 0 | dhm_size_G = sizeof(dhm_G_3072); |
90 | 0 | break; |
91 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 */ |
92 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096) |
93 | 0 | case sizeof(dhm_P_4096): |
94 | 0 | dhm_P = dhm_P_4096; |
95 | 0 | dhm_G = dhm_G_4096; |
96 | 0 | dhm_size_P = sizeof(dhm_P_4096); |
97 | 0 | dhm_size_G = sizeof(dhm_G_4096); |
98 | 0 | break; |
99 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 */ |
100 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144) |
101 | 0 | case sizeof(dhm_P_6144): |
102 | 0 | dhm_P = dhm_P_6144; |
103 | 0 | dhm_G = dhm_G_6144; |
104 | 0 | dhm_size_P = sizeof(dhm_P_6144); |
105 | 0 | dhm_size_G = sizeof(dhm_G_6144); |
106 | 0 | break; |
107 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 */ |
108 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192) |
109 | 0 | case sizeof(dhm_P_8192): |
110 | 0 | dhm_P = dhm_P_8192; |
111 | 0 | dhm_G = dhm_G_8192; |
112 | 0 | dhm_size_P = sizeof(dhm_P_8192); |
113 | 0 | dhm_size_G = sizeof(dhm_G_8192); |
114 | 0 | break; |
115 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 */ |
116 | 0 | default: |
117 | 0 | return PSA_ERROR_INVALID_ARGUMENT; |
118 | 0 | } |
119 | | |
120 | 0 | if (P != NULL) { |
121 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(P, dhm_P, |
122 | 0 | dhm_size_P)); |
123 | 0 | } |
124 | 0 | if (G != NULL) { |
125 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(G, dhm_G, |
126 | 0 | dhm_size_G)); |
127 | 0 | } |
128 | | |
129 | 0 | cleanup: |
130 | 0 | if (ret != 0) { |
131 | 0 | return mbedtls_to_psa_error(ret); |
132 | 0 | } |
133 | | |
134 | 0 | return PSA_SUCCESS; |
135 | 0 | } |
136 | | #endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT || |
137 | | MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE || |
138 | | MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY || |
139 | | MBEDTLS_PSA_BUILTIN_ALG_FFDH */ |
140 | | |
141 | | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \ |
142 | | defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) |
143 | | psa_status_t mbedtls_psa_ffdh_export_public_key( |
144 | | const psa_key_attributes_t *attributes, |
145 | | const uint8_t *key_buffer, |
146 | | size_t key_buffer_size, |
147 | | uint8_t *data, |
148 | | size_t data_size, |
149 | | size_t *data_length) |
150 | 0 | { |
151 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
152 | 0 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
153 | 0 | mbedtls_mpi GX, G, X, P; |
154 | 0 | psa_key_type_t type = attributes->type; |
155 | |
|
156 | 0 | if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type)) { |
157 | 0 | if (key_buffer_size > data_size) { |
158 | 0 | return PSA_ERROR_BUFFER_TOO_SMALL; |
159 | 0 | } |
160 | 0 | memcpy(data, key_buffer, key_buffer_size); |
161 | 0 | memset(data + key_buffer_size, 0, |
162 | 0 | data_size - key_buffer_size); |
163 | 0 | *data_length = key_buffer_size; |
164 | 0 | return PSA_SUCCESS; |
165 | 0 | } |
166 | | |
167 | 0 | mbedtls_mpi_init(&GX); mbedtls_mpi_init(&G); |
168 | 0 | mbedtls_mpi_init(&X); mbedtls_mpi_init(&P); |
169 | |
|
170 | 0 | size_t key_len = PSA_BITS_TO_BYTES(attributes->bits); |
171 | |
|
172 | 0 | status = mbedtls_psa_ffdh_set_prime_generator(key_len, &P, &G); |
173 | |
|
174 | 0 | if (status != PSA_SUCCESS) { |
175 | 0 | goto cleanup; |
176 | 0 | } |
177 | | |
178 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&X, key_buffer, |
179 | 0 | key_buffer_size)); |
180 | | |
181 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_exp_mod(&GX, &G, &X, &P, NULL)); |
182 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&GX, data, key_len)); |
183 | | |
184 | 0 | *data_length = key_len; |
185 | |
|
186 | 0 | ret = 0; |
187 | 0 | cleanup: |
188 | 0 | mbedtls_mpi_free(&P); mbedtls_mpi_free(&G); |
189 | 0 | mbedtls_mpi_free(&X); mbedtls_mpi_free(&GX); |
190 | |
|
191 | 0 | if (status == PSA_SUCCESS && ret != 0) { |
192 | 0 | status = mbedtls_to_psa_error(ret); |
193 | 0 | } |
194 | |
|
195 | 0 | return status; |
196 | 0 | } |
197 | | #endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT || |
198 | | MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY */ |
199 | | |
200 | | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE) |
201 | | psa_status_t mbedtls_psa_ffdh_generate_key( |
202 | | const psa_key_attributes_t *attributes, |
203 | | uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length) |
204 | 0 | { |
205 | 0 | mbedtls_mpi X, P; |
206 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
207 | 0 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
208 | 0 | mbedtls_mpi_init(&P); mbedtls_mpi_init(&X); |
209 | 0 | (void) attributes; |
210 | |
|
211 | 0 | status = mbedtls_psa_ffdh_set_prime_generator(key_buffer_size, &P, NULL); |
212 | |
|
213 | 0 | if (status != PSA_SUCCESS) { |
214 | 0 | goto cleanup; |
215 | 0 | } |
216 | | |
217 | | /* RFC7919: Traditional finite field Diffie-Hellman has each peer choose their |
218 | | secret exponent from the range [2, P-2]. |
219 | | Select random value in range [3, P-1] and decrease it by 1. */ |
220 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_random(&X, 3, &P, mbedtls_psa_get_random, |
221 | 0 | MBEDTLS_PSA_RANDOM_STATE)); |
222 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&X, &X, 1)); |
223 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&X, key_buffer, key_buffer_size)); |
224 | 0 | *key_buffer_length = key_buffer_size; |
225 | |
|
226 | 0 | cleanup: |
227 | 0 | mbedtls_mpi_free(&P); mbedtls_mpi_free(&X); |
228 | 0 | if (status == PSA_SUCCESS && ret != 0) { |
229 | 0 | return mbedtls_to_psa_error(ret); |
230 | 0 | } |
231 | | |
232 | 0 | return status; |
233 | 0 | } |
234 | | #endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE */ |
235 | | |
236 | | #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) |
237 | | psa_status_t mbedtls_psa_ffdh_import_key( |
238 | | const psa_key_attributes_t *attributes, |
239 | | const uint8_t *data, size_t data_length, |
240 | | uint8_t *key_buffer, size_t key_buffer_size, |
241 | | size_t *key_buffer_length, size_t *bits) |
242 | 0 | { |
243 | 0 | (void) attributes; |
244 | |
|
245 | 0 | if (key_buffer_size < data_length) { |
246 | 0 | return PSA_ERROR_BUFFER_TOO_SMALL; |
247 | 0 | } |
248 | 0 | memcpy(key_buffer, data, data_length); |
249 | 0 | *key_buffer_length = data_length; |
250 | 0 | *bits = PSA_BYTES_TO_BITS(data_length); |
251 | |
|
252 | 0 | return PSA_SUCCESS; |
253 | 0 | } |
254 | | #endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT */ |
255 | | |
256 | | #if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH) |
257 | | psa_status_t mbedtls_psa_ffdh_key_agreement( |
258 | | const psa_key_attributes_t *attributes, |
259 | | const uint8_t *peer_key, |
260 | | size_t peer_key_length, |
261 | | const uint8_t *key_buffer, |
262 | | size_t key_buffer_size, |
263 | | uint8_t *shared_secret, |
264 | | size_t shared_secret_size, |
265 | | size_t *shared_secret_length) |
266 | 0 | { |
267 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
268 | 0 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
269 | 0 | mbedtls_mpi P, G, X, GY, K; |
270 | 0 | const size_t calculated_shared_secret_size = peer_key_length; |
271 | |
|
272 | 0 | if (peer_key_length != key_buffer_size || |
273 | 0 | calculated_shared_secret_size > shared_secret_size) { |
274 | 0 | return PSA_ERROR_INVALID_ARGUMENT; |
275 | 0 | } |
276 | | |
277 | 0 | if (!PSA_KEY_TYPE_IS_DH_KEY_PAIR(psa_get_key_type(attributes))) { |
278 | 0 | return PSA_ERROR_INVALID_ARGUMENT; |
279 | 0 | } |
280 | | |
281 | 0 | mbedtls_mpi_init(&P); mbedtls_mpi_init(&G); |
282 | 0 | mbedtls_mpi_init(&X); mbedtls_mpi_init(&GY); |
283 | 0 | mbedtls_mpi_init(&K); |
284 | |
|
285 | 0 | status = mbedtls_psa_ffdh_set_prime_generator( |
286 | 0 | PSA_BITS_TO_BYTES(attributes->bits), &P, &G); |
287 | |
|
288 | 0 | if (status != PSA_SUCCESS) { |
289 | 0 | goto cleanup; |
290 | 0 | } |
291 | | |
292 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&X, key_buffer, |
293 | 0 | key_buffer_size)); |
294 | | |
295 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&GY, peer_key, |
296 | 0 | peer_key_length)); |
297 | | |
298 | | /* Calculate shared secret public key: K = G^(XY) mod P = GY^X mod P */ |
299 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_exp_mod(&K, &GY, &X, &P, NULL)); |
300 | | |
301 | 0 | MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&K, shared_secret, |
302 | 0 | calculated_shared_secret_size)); |
303 | | |
304 | 0 | *shared_secret_length = calculated_shared_secret_size; |
305 | |
|
306 | 0 | ret = 0; |
307 | |
|
308 | 0 | cleanup: |
309 | 0 | mbedtls_mpi_free(&P); mbedtls_mpi_free(&G); |
310 | 0 | mbedtls_mpi_free(&X); mbedtls_mpi_free(&GY); |
311 | 0 | mbedtls_mpi_free(&K); |
312 | |
|
313 | 0 | if (status == PSA_SUCCESS && ret != 0) { |
314 | 0 | status = mbedtls_to_psa_error(ret); |
315 | 0 | } |
316 | |
|
317 | 0 | return status; |
318 | 0 | } |
319 | | #endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */ |
320 | | |
321 | | #endif /* MBEDTLS_PSA_CRYPTO_C */ |